What is Gosec?
Gosec is a static analysis tool for Go source code that inspects the AST for security problems. It checks for issues like hardcoded credentials, SQL injection, directory traversal, and insecure use of cryptographic functions. Gosec is the standard SAST tool for Go projects and produces JSON output compatible with AppGuard ingestion.
Go-specific AST analysisBuilt-in rule set for Go securitySuppression comments supportedConfidence and severity levelsCI/CD friendly output
Integrate Gosec with AppGuard
1
Install Gosec
Install Gosec via Go.
go install github.com/securego/gosec/v2/cmd/gosec@latest
2
Run a scan
Run Gosec against your Go project.
gosec -fmt=json -out=results.json ./...
3
Push to AppGuard
Send the results to AppGuard.
curl -X POST "$APPGUARD_PUBLIC_URL/api/ingest" \ -H "X-Api-Token: $API_TOKEN" \ -F "[email protected]"
What AppGuard adds to Gosec
Cross-language correlation
See Go findings alongside Python, JavaScript, and other languages.
Severity trending
Track Gosec findings across releases to measure improvement.
Remediation tracking
Assign Go-specific findings to developers with due dates.